0

In crack since there is no check50 the assignment suggests inputting the 10 hashed passwords at the top of the assignment, but when I try that only 7/10 successfully return a password. Since the rest don't return anything I would like to know what they are so I can trace through my program using gdb or debug50 to see where the problem letters are. The entries of the hashed passwords that my program failed on were these:

mzlatkova:50CPlMDLT06yY

patrick:50WUNAFdX/yjA

wmartin:50vtwu4ujL.Dk

Would it be breaking the academic honesty policy to tell me what the passwords are unencrypted or hint at what they have in common so I can debug?

Here is my code if anyone wants, I have tried many different passwords of different lengths up to four with different chars both uppercase and lowercase, but so far none of them have been wrong, so I don't know what my code is skipping. I assume that pointer arithmetic is not the best way to go because of readability, but I want to use it until I can interchange between it and square bracket notation smoothly.

char *hash = *(argv + 1);
char *salt = "50";
// string must be maxlen + 1 for null (max is 4 char pass)
char string1[5];
bool found = false;

for (int i = 65; i < 123; i++)
{
    // always break out of each for loop if found correct pass
    if (found)
    {
        break;
    }
    //string1[0] = i;
    *(string1) = i;
    *(string1 + 1) = '\0';
    if (strcmp(hash, crypt(string1, salt)) == 0)
    {
        printf("%s\n", string1);
        found = true;
        break;
    }
    if (i == 90)
    {
        i = 96;
    }
    for (int j = 65; j < 123; j++)
    {
        if (found)
        {
            break;
        }
        *(string1 + 1) = j;
        *(string1 + 2) = '\0';
        if(strcmp(hash, crypt(string1, salt)) == 0)
        {
            printf("%s\n", string1);
            found = true;
            break;
        }
        if(j == 90)
        {
            j = 97;
        }
        for (int l = 65; l < 123; l++)
        {
            if (found)
            {
                break;
            }
            *(string1 + 2) = l;
            *(string1 + 3) = '\0';
            if(strcmp(hash, crypt(string1, salt)) == 0)
            {
                printf("%s\n", string1);
                found = true;
                break;
            }
            if(l == 90)
            {
                l = 97;
            }
            for (int k = 65; k < 123; k++)
            {
                if (found)
                {
                    break;
                }
                *(string1 + 3) = k;
                *(string1 + 4) = '\0';
                if(strcmp(hash, crypt(string1, salt)) == 0)
                {
                    printf("%s\n", string1);
                    found = true;
                    break;
                }
                if (k == 90)
                {
                    k = 97;
                }
            }
        }
    }
}
if (found)
{
    return 0;
}

}

3
  • The passwords change each year, so I guess it's OK to show you the plaintext passwords of a previous year, (I guess this years will be similar in spirit). 13, 12345678, crimson, bacon, password, 12345, n00b, l33t. – ChrisG Jun 22 '17 at 7:34
  • @ChrisG Sorry, I am still a little bit confused, are these passwords? I thought they could only be alphabetical characters with a max length of four as it says in the specification? But I think they may have changed that too, since when I was looking around for answers to my question before people seemed to be talking about 8 char passwords taking 30min to crack. I suppose I could try to modify my code to accept numbers and longer strings? Actually I guess in 2015 it was all ASCII characters, wow that is a lot harder than the version of crack now. – dumbitdownjr Jun 22 '17 at 21:27
  • @ChrisG I get it if it spoils the challenge of trying to uncover the current passwords in crack, would it be better if I post some of my code so that you or someone else can see what is going wrong? – dumbitdownjr Jun 22 '17 at 21:50

You must log in to answer this question.

Browse other questions tagged .